npm - @tearleads/client-sdk - Versions diffs - 0.1.41 → 0.1.43 - Mend

@tearleads/client-sdk 0.1.41 → 0.1.43

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (235) hide show

package/workflows/containers/child/mutationRequestCore.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mutationRequestCore.js","sourceRoot":"","sources":["mutationRequestCore.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,~~yBAAyB~~,EAAE,MAAM,4CAA4C,CAAC;~~AACvF~~,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAG3C,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,KAAa;IAEb,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED~~;;;GAGG~~;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAA0C,EAC1C,kBAAqD;IAKrD,OAAO;QACL,gBAAgB;~~QAChB~~,~~qBAAqB~~,~~EAAE~~,kBAAkB,CAAC,IAAI,CAAC,GAAG,~~CAChD~~,~~yBAAyB~~,~~CAC1B~~;~~KACF~~,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,KASC;IAYD,MAAM,KAAK,GAAG,aAAa,SAAS,EAAE,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACzD,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC;QACtD,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAClE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,4BAA4B,CAAC,MAAM,CAAC,CACrC,EACD,GAAG,KAAK,qBAAqB,CAC9B;QACD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,YAAY,CAAC;QACnE,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC1D,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,GAAG,KAAK,sBAAsB,CAC/B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { ~~asContainerManifestBundle~~ } from \"../../../data/containers/shared/projection\";\nimport {\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function readCanonicalRecordOrNull(\n value: unknown,\n label: string,\n): Record<string, unknown> \| null {\n return value === null \|\| value === undefined\n ? null\n : readCanonicalRecord(value, label);\n}\n\n/*\n The previous-manifest identity every non-create mutation\n * (share/rekey/revoke/move) sends alongside the core request fields.\n /\nexport function previousPathRequestFields(\n previousManifest: AccessManifestBundleWire,\n previousProjection: ContainerWriterProjectionResponse,\n): Pick<\n ContainerMutationRequest,\n \"~~previousManifest~~\" \| \"~~previousContainerPath~~\"\n> {\n return {\n previousManifest,\n ~~previousContainerPath:~~ previousProjection.path.map(~~\n asContainerManifestBundle,\n~~ ),\n };\n}\n\n/\n The eight ContainerMutationRequest fields every child-container mutation\n * (create/share/rekey/revoke/move) assembles identically, labeled by\n * operation. The identity fields — previous manifest/path, manifest history,\n * predecessor bridge, keyring, and the parent KEK — genuinely differ per\n * operation and stay with each builder.\n */\nexport function containerMutationRequestCore(\n operation: string,\n input: {\n body: unknown;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n },\n): Pick<\n ContainerMutationRequest,\n \| \"event\"\n \| \"body\"\n \| \"expectedManifestHash\"\n \| \"manifest\"\n \| \"principalPolicies\"\n \| \"keyEpoch\"\n \| \"wraps\"\n \| \"userRecipientKeys\"\n> {\n const label = `Container ${operation}`;\n return {\n event: readCanonicalRecord(input.event, `${label} event`),\n body: readCanonicalRecord(input.body, `${label} body`),\n expectedManifestHash: input.manifestHash,\n manifest: readCanonicalRecord(input.manifest, `${label} manifest`),\n principalPolicies: readCanonicalRecords(\n input.principalPolicies.map((policy) =>\n principalPolicyRequestRecord(policy),\n ),\n `${label} principal policies`,\n ),\n keyEpoch: readCanonicalRecord(input.keyEpoch, `${label} key epoch`),\n wraps: readCanonicalRecords(input.wraps, `${label} wraps`),\n userRecipientKeys: readCanonicalRecords(\n input.userRecipientKeys,\n `${label} user recipient keys`,\n ),\n };\n}\n"]}
1	+ {"version":3,"file":"mutationRequestCore.js","sourceRoot":"","sources":["mutationRequestCore.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAG3C,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,KAAa;IAEb,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAC1C,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAA0C,EAC1C,kBAAqD;IAKrD,OAAO;QACL,mBAAmB,EAAE,oBAAoB,CAAC,gBAAgB,CAAC;QAC3D,yBAAyB,EACvB,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAC1C,SAAiB,EACjB,KASC;IAYD,MAAM,KAAK,GAAG,aAAa,SAAS,EAAE,CAAC;IACvC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACzD,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC;QACtD,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC;QAClE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrC,4BAA4B,CAAC,MAAM,CAAC,CACrC,EACD,GAAG,KAAK,qBAAqB,CAC9B;QACD,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,YAAY,CAAC;QACnE,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QAC1D,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,GAAG,KAAK,sBAAsB,CAC/B;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport {\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function readCanonicalRecordOrNull(\n value: unknown,\n label: string,\n): Record<string, unknown> \| null {\n return value === null \|\| value === undefined\n ? null\n : readCanonicalRecord(value, label);\n}\n\n/*\n The previous-manifest identity every non-create mutation\n * (share/rekey/revoke/move) sends alongside the core request fields: the\n * previous head and the current path, cited by hash rather than echoed.\n /\nexport function previousPathRequestFields(\n previousManifest: AccessManifestBundleWire,\n previousProjection: ContainerWriterProjectionResponse,\n): Pick<\n ContainerMutationRequest,\n \"previousManifestRef\" \| \"previousContainerPathRefs\"\n> {\n return {\n previousManifestRef: containerManifestRef(previousManifest),\n previousContainerPathRefs:\n previousProjection.path.map(containerManifestRef),\n };\n}\n\n/\n The eight ContainerMutationRequest fields every child-container mutation\n * (create/share/rekey/revoke/move) assembles identically, labeled by\n * operation. The identity fields — previous manifest/path, manifest history,\n * predecessor bridge, keyring, and the parent KEK — genuinely differ per\n * operation and stay with each builder.\n */\nexport function containerMutationRequestCore(\n operation: string,\n input: {\n body: unknown;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n },\n): Pick<\n ContainerMutationRequest,\n \| \"event\"\n \| \"body\"\n \| \"expectedManifestHash\"\n \| \"manifest\"\n \| \"principalPolicies\"\n \| \"keyEpoch\"\n \| \"wraps\"\n \| \"userRecipientKeys\"\n> {\n const label = `Container ${operation}`;\n return {\n event: readCanonicalRecord(input.event, `${label} event`),\n body: readCanonicalRecord(input.body, `${label} body`),\n expectedManifestHash: input.manifestHash,\n manifest: readCanonicalRecord(input.manifest, `${label} manifest`),\n principalPolicies: readCanonicalRecords(\n input.principalPolicies.map((policy) =>\n principalPolicyRequestRecord(policy),\n ),\n `${label} principal policies`,\n ),\n keyEpoch: readCanonicalRecord(input.keyEpoch, `${label} key epoch`),\n wraps: readCanonicalRecords(input.wraps, `${label} wraps`),\n userRecipientKeys: readCanonicalRecords(\n input.userRecipientKeys,\n `${label} user recipient keys`,\n ),\n };\n}\n"]}

package/workflows/containers/child/recitePlan.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { computeAccessManifestHash, deriveContainerAccessManifest, KeyingVerificationError, MAX_CONTAINER_RECITATION_EPOCH, resolveContainerStatePathUserAccessLevel, } from "../../../internal/crypto/index.js";
 import { signContainerMutationEvent } from "../../../data/containers/shared/events.js";
 import { principalPolicyRequestRecord } from "../../../data/containers/shared/principalPolicies.js";
+import { containerManifestRef } from "../../../data/containers/shared/projection.js";
 import { canonicalKeyingJsonString, readCanonicalRecord, } from "../../../data/keyingCanonicalJson.js";
 export function referencedRecitationPolicies(path, policies) {
     const referencedIds = new Set(path.flatMap((head) => head.state.referencedPrincipalHeads.map((ref) => `${ref.principalType}:${ref.principalId}`)));
@@ -50,8 +51,8 @@ export async function buildContainerRecitePlan(input) {
         event: readCanonicalRecord(event, "Recitation event"),
         manifest: readCanonicalRecord(manifest, "Recitation manifest"),
         expectedManifestHash: manifestHash,
-        previousManifest: previous.bundle,
-        previousContainerPath: input.path.map((head) => head.bundle),
+        previousManifestRef: containerManifestRef(previous.bundle),
+        previousContainerPathRefs: input.path.map((head) => containerManifestRef(head.bundle)),
         principalPolicies: referencedRecitationPolicies(input.path, input.policies).map((policy) => principalPolicyRequestRecord(policy)),
     };
     return { body, event, eventHash, manifest, manifestHash, state, request };

package/workflows/containers/child/recitePlan.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"recitePlan.js","sourceRoot":"","sources":["recitePlan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;~~AAEjG~~,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,QAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CACnD,CACF,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,wCAAwC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,KAAK,OAAO,EACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,kBAA2B;QACtC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,qBAAqB;KAC5D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;QAClD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,KAAK;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/B,SAAS;QACT,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACrD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC9D,oBAAoB,EAAE,YAAY;QAClC,~~gBAAgB~~,EAAE,QAAQ,CAAC,MAAM;~~QACjC~~,~~qBAAqB~~,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;~~QAC5D~~,iBAAiB,EAAE,4BAA4B,CAC7C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,CACf,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,IAA0D,EAC1D,QAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,iBAAiB,GAAG;QACxB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACxD,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACzD,CAAC;IACF,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAC/C,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAClD,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACzC,CAAC,iBAAiB;QAClB,yBAAyB,CACvB,QAAQ,CAAC,wBAAwB,EACjC,uBAAuB,CACxB;YACC,yBAAyB,CACvB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EACtC,+BAA+B,CAChC;QAEH,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n computeAccessManifestHash,\n deriveContainerAccessManifest,\n KeyingVerificationError,\n MAX_CONTAINER_RECITATION_EPOCH,\n resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerReciteRequest } from \"@tearleads/validators/request\";\nimport type { ContainerReciteResponse } from \"@tearleads/validators/response\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport type { HeldContainerHead } from \"../../../data/containers/shared/heldContainerHeads\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n} from \"../../../data/keyingCanonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function referencedRecitationPolicies(\n path: readonly HeldContainerHead[],\n policies: readonly PrincipalPolicyCheckpointEvidence[],\n): readonly PrincipalPolicyCheckpointEvidence[] {\n const referencedIds = new Set(\n path.flatMap((head) =>\n head.state.referencedPrincipalHeads.map(\n (ref) => `${ref.principalType}:${ref.principalId}`,\n ),\n ),\n );\n return policies.filter((policy) =>\n referencedIds.has(`${policy.principalType}:${policy.principalId}`),\n );\n}\n\nexport async function buildContainerRecitePlan(input: {\n readonly author: ContainerMutationAuthor;\n readonly path: readonly HeldContainerHead[];\n readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}) {\n const previous = input.path.at(-1);\n if (!previous) throw new Error(\"Recitation requires a held container path\");\n if (previous.state.epoch >= MAX_CONTAINER_RECITATION_EPOCH) {\n throw new Error(\"Container re-citation history budget is exhausted\");\n }\n if (\n input.path.some(\n (head) => head.state.organizationId !== input.author.organizationId,\n )\n ) {\n throw new Error(\"Recitation cannot cross organizations\");\n }\n if (\n resolveContainerStatePathUserAccessLevel({\n states: input.path.map((head) => head.state),\n principalPolicies: input.policies,\n userId: input.author.signerUserId,\n }) !== \"admin\"\n ) {\n throw new KeyingVerificationError(\n \"unauthorized\",\n \"Container re-citation signer lacks admin access on the held path\",\n );\n }\n const body = {\n eventType: \"container.recite\" as const,\n containerKeyEpochId: previous.state.containerKeyEpochId,\n containerKeyPublicKey: previous.state.containerKeyPublicKey,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previous.state.containerId,\n dependencyManifestHashes: input.path.map(\n (head) => head.bundle.manifestHash,\n ),\n eventId: crypto.randomUUID(),\n previousManifestHash: previous.bundle.manifestHash,\n signedAt: new Date().toISOString(),\n });\n const state = {\n ...previous.state,\n epoch: previous.state.epoch + 1,\n eventHash,\n previousManifestHash: previous.bundle.manifestHash,\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const request: ContainerReciteRequest = {\n body,\n event: readCanonicalRecord(event, \"Recitation event\"),\n manifest: readCanonicalRecord(manifest, \"Recitation manifest\"),\n expectedManifestHash: manifestHash,\n ~~previousManifest~~: previous.bundle,\n ~~previousContainerPath~~: input.path.map((head) => head.bundle),\n principalPolicies: referencedRecitationPolicies(\n input.path,\n input.policies,\n ).map((policy) => principalPolicyRequestRecord(policy)),\n };\n return { body, event, eventHash, manifest, manifestHash, state, request };\n}\n\nexport function assertContainerReciteAcknowledgement(\n plan: Awaited<ReturnType<typeof buildContainerRecitePlan>>,\n response: ContainerReciteResponse,\n): void {\n const bundle = response.accessManifest;\n const signedFieldsMatch = [\n [bundle.event.event, plan.event],\n [bundle.event.body, plan.body],\n [bundle.manifest, plan.manifest],\n [bundle.state, plan.state],\n ].every(\n ([actual, expected]) =>\n canonicalKeyingJsonString(actual, \"Recitation response\") ===\n canonicalKeyingJsonString(expected, \"Recitation plan\"),\n );\n if (\n response.containerId !== plan.state.containerId \|\|\n response.organizationId !== plan.state.organizationId \|\|\n response.parentId !== plan.state.parentContainerId \|\|\n response.manifestHead.epoch !== plan.state.epoch \|\|\n response.manifestHead.manifestHash !== plan.manifestHash \|\|\n bundle.manifestHash !== plan.manifestHash \|\|\n bundle.event.eventHash !== plan.eventHash \|\|\n !signedFieldsMatch \|\|\n canonicalKeyingJsonString(\n response.referencedPrincipalHeads,\n \"Recitation references\",\n ) !==\n canonicalKeyingJsonString(\n plan.manifest.referencedPrincipalHeads,\n \"Recitation planned references\",\n )\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Container recitation response does not match the signed plan\",\n );\n}\n"]}
1	+ {"version":3,"file":"recitePlan.js","sourceRoot":"","sources":["recitePlan.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,uBAAuB,EACvB,8BAA8B,EAC9B,wCAAwC,GACzC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,wCAAwC,CAAC;AAEpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAElF,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,MAAM,UAAU,4BAA4B,CAC1C,IAAkC,EAClC,QAAsD;IAEtD,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,GAAG,CACrC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,WAAW,EAAE,CACnD,CACF,CACF,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAChC,aAAa,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,IAAI,CACb,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,MAAM,CAAC,cAAc,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,wCAAwC,CAAC;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,iBAAiB,EAAE,KAAK,CAAC,QAAQ;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,KAAK,OAAO,EACd,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,kBAA2B;QACtC,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB;QACvD,qBAAqB,EAAE,QAAQ,CAAC,KAAK,CAAC,qBAAqB;KAC5D,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,0BAA0B,CAAC;QAC5D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW;QACvC,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CACtC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CACnC;QACD,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;QAClD,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,KAAK;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;QAC/B,SAAS;QACT,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY;KACnD,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAA2B;QACtC,IAAI;QACJ,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,CAAC;QACrD,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAC9D,oBAAoB,EAAE,YAAY;QAClC,mBAAmB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC1D,yBAAyB,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAClC;QACD,iBAAiB,EAAE,4BAA4B,CAC7C,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,CACf,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,IAA0D,EAC1D,QAAiC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,iBAAiB,GAAG;QACxB,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC;QAChC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC,KAAK,CACL,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CACrB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACxD,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CACzD,CAAC;IACF,IACE,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW;QAC/C,QAAQ,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc;QACrD,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAClD,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAChD,QAAQ,CAAC,YAAY,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACxD,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACzC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;QACzC,CAAC,iBAAiB;QAClB,yBAAyB,CACvB,QAAQ,CAAC,wBAAwB,EACjC,uBAAuB,CACxB;YACC,yBAAyB,CACvB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EACtC,+BAA+B,CAChC;QAEH,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,8DAA8D,CAC/D,CAAC;AACN,CAAC","sourcesContent":["import {\n computeAccessManifestHash,\n deriveContainerAccessManifest,\n KeyingVerificationError,\n MAX_CONTAINER_RECITATION_EPOCH,\n resolveContainerStatePathUserAccessLevel,\n} from \"@tearleads/crypto\";\nimport type { ContainerReciteRequest } from \"@tearleads/validators/request\";\nimport type { ContainerReciteResponse } from \"@tearleads/validators/response\";\nimport { signContainerMutationEvent } from \"../../../data/containers/shared/events\";\nimport type { HeldContainerHead } from \"../../../data/containers/shared/heldContainerHeads\";\nimport { principalPolicyRequestRecord } from \"../../../data/containers/shared/principalPolicies\";\nimport { containerManifestRef } from \"../../../data/containers/shared/projection\";\nimport type { ContainerMutationAuthor } from \"../../../data/containers/shared/types\";\nimport {\n canonicalKeyingJsonString,\n readCanonicalRecord,\n} from \"../../../data/keyingCanonicalJson\";\nimport type { PrincipalPolicyCheckpointEvidence } from \"../../../data/principals/principalPolicyEvidence\";\n\nexport function referencedRecitationPolicies(\n path: readonly HeldContainerHead[],\n policies: readonly PrincipalPolicyCheckpointEvidence[],\n): readonly PrincipalPolicyCheckpointEvidence[] {\n const referencedIds = new Set(\n path.flatMap((head) =>\n head.state.referencedPrincipalHeads.map(\n (ref) => `${ref.principalType}:${ref.principalId}`,\n ),\n ),\n );\n return policies.filter((policy) =>\n referencedIds.has(`${policy.principalType}:${policy.principalId}`),\n );\n}\n\nexport async function buildContainerRecitePlan(input: {\n readonly author: ContainerMutationAuthor;\n readonly path: readonly HeldContainerHead[];\n readonly policies: readonly PrincipalPolicyCheckpointEvidence[];\n}) {\n const previous = input.path.at(-1);\n if (!previous) throw new Error(\"Recitation requires a held container path\");\n if (previous.state.epoch >= MAX_CONTAINER_RECITATION_EPOCH) {\n throw new Error(\"Container re-citation history budget is exhausted\");\n }\n if (\n input.path.some(\n (head) => head.state.organizationId !== input.author.organizationId,\n )\n ) {\n throw new Error(\"Recitation cannot cross organizations\");\n }\n if (\n resolveContainerStatePathUserAccessLevel({\n states: input.path.map((head) => head.state),\n principalPolicies: input.policies,\n userId: input.author.signerUserId,\n }) !== \"admin\"\n ) {\n throw new KeyingVerificationError(\n \"unauthorized\",\n \"Container re-citation signer lacks admin access on the held path\",\n );\n }\n const body = {\n eventType: \"container.recite\" as const,\n containerKeyEpochId: previous.state.containerKeyEpochId,\n containerKeyPublicKey: previous.state.containerKeyPublicKey,\n };\n const { event, eventHash } = await signContainerMutationEvent({\n author: input.author,\n body,\n containerId: previous.state.containerId,\n dependencyManifestHashes: input.path.map(\n (head) => head.bundle.manifestHash,\n ),\n eventId: crypto.randomUUID(),\n previousManifestHash: previous.bundle.manifestHash,\n signedAt: new Date().toISOString(),\n });\n const state = {\n ...previous.state,\n epoch: previous.state.epoch + 1,\n eventHash,\n previousManifestHash: previous.bundle.manifestHash,\n };\n const manifest = await deriveContainerAccessManifest(state);\n const manifestHash = await computeAccessManifestHash(manifest);\n const request: ContainerReciteRequest = {\n body,\n event: readCanonicalRecord(event, \"Recitation event\"),\n manifest: readCanonicalRecord(manifest, \"Recitation manifest\"),\n expectedManifestHash: manifestHash,\n previousManifestRef: containerManifestRef(previous.bundle),\n previousContainerPathRefs: input.path.map((head) =>\n containerManifestRef(head.bundle),\n ),\n principalPolicies: referencedRecitationPolicies(\n input.path,\n input.policies,\n ).map((policy) => principalPolicyRequestRecord(policy)),\n };\n return { body, event, eventHash, manifest, manifestHash, state, request };\n}\n\nexport function assertContainerReciteAcknowledgement(\n plan: Awaited<ReturnType<typeof buildContainerRecitePlan>>,\n response: ContainerReciteResponse,\n): void {\n const bundle = response.accessManifest;\n const signedFieldsMatch = [\n [bundle.event.event, plan.event],\n [bundle.event.body, plan.body],\n [bundle.manifest, plan.manifest],\n [bundle.state, plan.state],\n ].every(\n ([actual, expected]) =>\n canonicalKeyingJsonString(actual, \"Recitation response\") ===\n canonicalKeyingJsonString(expected, \"Recitation plan\"),\n );\n if (\n response.containerId !== plan.state.containerId \|\|\n response.organizationId !== plan.state.organizationId \|\|\n response.parentId !== plan.state.parentContainerId \|\|\n response.manifestHead.epoch !== plan.state.epoch \|\|\n response.manifestHead.manifestHash !== plan.manifestHash \|\|\n bundle.manifestHash !== plan.manifestHash \|\|\n bundle.event.eventHash !== plan.eventHash \|\|\n !signedFieldsMatch \|\|\n canonicalKeyingJsonString(\n response.referencedPrincipalHeads,\n \"Recitation references\",\n ) !==\n canonicalKeyingJsonString(\n plan.manifest.referencedPrincipalHeads,\n \"Recitation planned references\",\n )\n )\n throw new KeyingVerificationError(\n \"object_mismatch\",\n \"Container recitation response does not match the signed plan\",\n );\n}\n"]}

package/workflows/containers/child/sharePlanCore.js CHANGED Viewed

@@ -1,6 +1,6 @@
 import { computeAccessManifestHash, deriveContainerAccessManifest, } from "../../../internal/crypto/index.js";
 import { uniquePrincipalPolicies } from "../../../data/containers/shared/principalPolicies.js";
-import { asContainerManifestBundle, getParentKekForTarget, readContainerState, } from "../../../data/containers/shared/projection.js";
+import { asContainerManifestBundle, containerManifestRef, getParentKekForTarget, readContainerState, } from "../../../data/containers/shared/projection.js";
 import { readContainerKekRecipientTargets, readContainerKeyEpoch, } from "../../../data/containers/shared/readers.js";
 import { collectContainerWriterProjectionPrincipalPolicies, } from "../../../data/keyingProjectionVerification.js";
 import { containerMutationRequestCore, previousPathRequestFields, readCanonicalRecordOrNull, } from "./mutationRequestCore.js";
@@ -90,7 +90,7 @@ function buildContainerShareRequest(input) {
     return {
         ...containerMutationRequestCore("share", input),
         ...previousPathRequestFields(input.previousManifest, input.previousProjection),
-        containerManifestHistory: [...input.containerManifestHistory],
+        containerManifestHistoryRefs: input.containerManifestHistory.map(containerManifestRef),
         predecessorBridge: null,
         keyring: null,
         parentKekState: readCanonicalRecordOrNull(input.parentKek, "Container share parent KEK state"),

package/workflows/containers/child/sharePlanCore.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,wBAAwB,EAAE,CAAC,GAAG,KAAK,CAAC,wBAAwB,CAAC;QAC7D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerAccessManifestState,\n type ContainerDirectGrant,\n type ContainerGrantAccessEventBody,\n type ContainerGrantPrincipalHead,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n type ContainerUserRecipientKey,\n computeAccessManifestHash,\n deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n asContainerManifestBundle,\n getParentKekForTarget,\n readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n readContainerKekRecipientTargets,\n readContainerKeyEpoch,\n} from \"../../../data/containers/shared/readers\";\nimport type {\n ContainerSharePlan,\n MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n \| {\n readonly recipientEncapsulationPublicKey: Uint8Array;\n readonly subjectId: string;\n readonly subjectType: \"user\";\n }\n \| {\n readonly principalPolicy: PrincipalPolicyCurrentEvidence;\n readonly subjectId: string;\n readonly subjectType: \"group\";\n };\n\nfunction grantKey(\n grant: Pick<ContainerDirectGrant, \"subjectId\" \| \"subjectType\">,\n): string {\n return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n grants: readonly ContainerDirectGrant[],\n grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n return [\n ...grants.filter(\n (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n ),\n grant,\n ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n readonly principalId: string;\n readonly principalType: \"group\";\n}): string {\n return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n policy: PrincipalPolicyCurrentEvidence,\n): ContainerGrantPrincipalHead {\n if (policy.principalType !== \"group\") {\n throw new Error(\"Container grants can reference only group policies\");\n }\n return {\n principalType: \"group\",\n principalId: policy.principalId,\n version: policy.version,\n keyEpoch: policy.keyEpoch,\n stateHash: policy.stateHash,\n keyFingerprint: policy.state.keyFingerprint,\n };\n}\n\nfunction upsertReferencedPrincipalHead(\n references: readonly ContainerGrantPrincipalHead[],\n reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n return [\n ...references.filter(\n (existingReference) =>\n referencedPrincipalKey(existingReference) !==\n referencedPrincipalKey(reference),\n ),\n reference,\n ].sort((left, right) =>\n referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n );\n}\n\n/*\n The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n /\nexport function refreshedPrincipalReferences(input: {\n readonly previousState: ContainerAccessManifestState;\n readonly replacementPrincipalPolicy?:\n \| PrincipalPolicyCurrentEvidence\n \| undefined;\n}): ContainerGrantPrincipalHead[] {\n const replacement = input.replacementPrincipalPolicy;\n if (\n !replacement \|\|\n !input.previousState.directGrants.some(\n (grant) =>\n grant.subjectType === replacement.principalType &&\n grant.subjectId === replacement.principalId,\n )\n ) {\n return [...input.previousState.referencedPrincipalHeads];\n }\n return upsertReferencedPrincipalHead(\n input.previousState.referencedPrincipalHeads,\n referencedPrincipalHeadFromPolicy(replacement),\n );\n}\n\n/\n The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];\n readonly replacementPrincipalPolicy?:\n \| PrincipalPolicyCurrentEvidence\n \| undefined;\n}): PrincipalPolicyCurrentEvidence[] {\n const replacement = input.replacementPrincipalPolicy;\n if (!replacement) {\n return uniquePrincipalPolicies(input.previousPolicies);\n }\n return uniquePrincipalPolicies([\n ...input.previousPolicies.filter(\n (policy) =>\n policy.principalType !== replacement.principalType \|\|\n policy.principalId !== replacement.principalId,\n ),\n replacement,\n ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n eventHash: string;\n grant: ContainerDirectGrant;\n previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n referencedPrincipalHead: ContainerGrantPrincipalHead \| null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" \| \"manifestHash\" \| \"state\">> {\n const previousState = readContainerState(input.previousManifest);\n const state: ContainerAccessManifestState = {\n ...previousState,\n epoch: previousState.epoch + 1,\n previousManifestHash: input.previousManifest.manifestHash,\n eventHash: input.eventHash,\n directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n referencedPrincipalHeads: input.referencedPrincipalHead\n ? upsertReferencedPrincipalHead(\n previousState.referencedPrincipalHeads,\n input.referencedPrincipalHead,\n )\n : previousState.referencedPrincipalHeads,\n };\n const manifest = await deriveContainerAccessManifest(state);\n\n return {\n manifest,\n manifestHash: await computeAccessManifestHash(manifest),\n state,\n };\n}\n\nfunction buildContainerShareRequest(input: {\n body: ContainerGrantAccessEventBody;\n containerManifestHistory: readonly AccessManifestBundleWire[];\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"share\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n containerManifestHistory: [...input.containerManifestHistory],\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container share parent KEK state\",\n ),\n };\n}\n\nexport function replaceContainerWrap(\n wraps: readonly ContainerKeyWrap[],\n nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n return [\n ...wraps.filter(\n (wrap) =>\n !(\n wrap.recipientKind === nextWrap.recipientKind &&\n wrap.recipientId === nextWrap.recipientId\n ),\n ),\n nextWrap,\n ];\n}\n\nexport function shareManifestHistory(input: {\n readonly containerId: string;\n readonly targetKek: ContainerKekResponse;\n readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n const byHash = new Map<string, AccessManifestBundleWire>();\n for (const bundle of [\n input.targetManifest,\n ...input.targetKek.containerManifestHistory,\n ]) {\n if (\n readContainerState(bundle).containerId === input.containerId &&\n !byHash.has(bundle.manifestHash)\n ) {\n byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n }\n }\n return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n body: ContainerGrantAccessEventBody;\n containerManifestHistory: readonly AccessManifestBundleWire[];\n containerId: string;\n containerKey: Uint8Array;\n event: AccessEvent;\n eventHash: string;\n grant: ContainerDirectGrant;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n recipientTarget: ContainerKekRecipientTarget;\n state: ContainerAccessManifestState;\n targetKek: ContainerKekResponse;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n const keyEpoch = readContainerKeyEpoch(\n input.targetKek.keyEpoch,\n \"Container share key epoch\",\n );\n const plan: ContainerSharePlan = {\n body: input.body,\n containerId: input.containerId,\n event: input.event,\n eventHash: input.eventHash,\n grant: input.grant,\n keyEpoch,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousKeyring: readCanonicalRecordOrNull(\n input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n \"Container share previous keyring\",\n ),\n previousManifest: input.previousManifest,\n recipientTarget: input.recipientTarget,\n request: buildContainerShareRequest({\n body: input.body,\n containerManifestHistory: input.containerManifestHistory,\n event: input.event,\n keyEpoch,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n parentKek: getParentKekForTarget(input.previousProjection),\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n newUserRecipientKey?: ContainerUserRecipientKey \| undefined;\n state: ContainerAccessManifestState;\n targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n const directUserIds = new Set(\n input.state.directGrants.flatMap((grant) =>\n grant.subjectType === \"user\" ? [grant.subjectId] : [],\n ),\n );\n const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n for (const target of readContainerKekRecipientTargets(\n input.targetKek.recipientTargets,\n \"Container share target KEK recipient targets\",\n )) {\n if (\n target.recipientKind !== \"user\" \|\|\n !directUserIds.has(target.recipientId)\n ) {\n continue;\n }\n userRecipientKeyByUserId.set(target.recipientId, {\n userId: target.recipientId,\n recipientKeyEpochId: target.recipientKeyEpochId,\n recipientKeyFingerprint: target.recipientKeyFingerprint,\n });\n }\n\n if (input.newUserRecipientKey) {\n userRecipientKeyByUserId.set(\n input.newUserRecipientKey.userId,\n input.newUserRecipientKey,\n );\n }\n\n const missingUserId = [...directUserIds].find(\n (userId) => !userRecipientKeyByUserId.has(userId),\n );\n if (missingUserId) {\n throw new Error(\n `Container share recipient key is missing for direct user grant ${missingUserId}`,\n );\n }\n\n return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n left.userId.localeCompare(right.userId),\n );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n execSql: ExecSql;\n persistVerificationCheckpoints?: boolean \| undefined;\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n recipientPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n resolveUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) \| undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n const previousPolicies =\n await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n principalPolicyCache: input.principalPolicyCache,\n projection: input.previousProjection,\n resolveUserKey: input.resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return refreshedPrincipalPolicies({\n previousPolicies,\n replacementPrincipalPolicy: input.recipientPolicy,\n });\n}\n"]}
1	+ {"version":3,"file":"sharePlanCore.js","sourceRoot":"","sources":["sharePlanCore.ts"],"names":[],"mappings":"AAAA,OAAO,EAWL,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAC5F,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,gCAAgC,EAChC,qBAAqB,GACtB,MAAM,yCAAyC,CAAC;AAKjD,OAAO,EACL,iDAAiD,GAIlD,MAAM,4CAA4C,CAAC;AAGpD,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B,SAAS,QAAQ,CACf,KAA8D;IAE9D,OAAO,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAuC,EACvC,KAA2B;IAE3B,OAAO;QACL,GAAG,MAAM,CAAC,MAAM,CACd,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,CAC/D;QACD,KAAK;KACN,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAG/B;IACC,OAAO,GAAG,SAAS,CAAC,aAAa,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,MAAsC;IAEtC,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,OAAO;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,UAAkD,EAClD,SAAsC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,MAAM,CAClB,CAAC,iBAAiB,EAAE,EAAE,CACpB,sBAAsB,CAAC,iBAAiB,CAAC;YACzC,sBAAsB,CAAC,SAAS,CAAC,CACpC;QACD,SAAS;KACV,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,sBAAsB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IACE,CAAC,WAAW;QACZ,CAAC,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,CACpC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,aAAa;YAC/C,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,WAAW,CAC9C,EACD,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,6BAA6B,CAClC,KAAK,CAAC,aAAa,CAAC,wBAAwB,EAC5C,iCAAiC,CAAC,WAAW,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,uBAAuB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,uBAAuB,CAAC;QAC7B,GAAG,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAC9B,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAClD,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC,WAAW,CACjD;QACD,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAKlD;IACC,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiC;QAC1C,GAAG,aAAa;QAChB,KAAK,EAAE,aAAa,CAAC,KAAK,GAAG,CAAC;QAC9B,oBAAoB,EAAE,KAAK,CAAC,gBAAgB,CAAC,YAAY;QACzD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,YAAY,EAAE,oBAAoB,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;QAC3E,wBAAwB,EAAE,KAAK,CAAC,uBAAuB;YACrD,CAAC,CAAC,6BAA6B,CAC3B,aAAa,CAAC,wBAAwB,EACtC,KAAK,CAAC,uBAAuB,CAC9B;YACH,CAAC,CAAC,aAAa,CAAC,wBAAwB;KAC3C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,6BAA6B,CAAC,KAAK,CAAC,CAAC;IAE5D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,yBAAyB,CAAC,QAAQ,CAAC;QACvD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAanC;IACC,OAAO;QACL,GAAG,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC;QAC/C,GAAG,yBAAyB,CAC1B,KAAK,CAAC,gBAAgB,EACtB,KAAK,CAAC,kBAAkB,CACzB;QACD,4BAA4B,EAC1B,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1D,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,yBAAyB,CACvC,KAAK,CAAC,SAAS,EACf,kCAAkC,CACnC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAkC,EAClC,QAA0B;IAE1B,OAAO;QACL,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CACC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,aAAa;YAC7C,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC1C,CACJ;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAIpC;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,MAAM,IAAI;QACnB,KAAK,CAAC,cAAc;QACpB,GAAG,KAAK,CAAC,SAAS,CAAC,wBAAwB;KAC5C,EAAE,CAAC;QACF,IACE,kBAAkB,CAAC,MAAM,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAC5D,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAChC,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,yBAAyB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAkB7C;IACC,MAAM,QAAQ,GAAG,qBAAqB,CACpC,KAAK,CAAC,SAAS,CAAC,QAAQ,EACxB,2BAA2B,CAC5B,CAAC;IACF,MAAM,IAAI,GAAuB;QAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ;QACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,EAC9D,kCAAkC,CACnC;QACD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,OAAO,EAAE,0BAA0B,CAAC;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,qBAAqB,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC1D,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI7C;IACC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD,CACF,CAAC;IACF,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE9E,KAAK,MAAM,MAAM,IAAI,gCAAgC,CACnD,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAChC,8CAA8C,CAC/C,EAAE,CAAC;QACF,IACE,MAAM,CAAC,aAAa,KAAK,MAAM;YAC/B,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EACtC,CAAC;YACD,SAAS;QACX,CAAC;QACD,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;SACxD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC9B,wBAAwB,CAAC,GAAG,CAC1B,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAChC,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,MAAM,CAAC,CAClD,CAAC;IACF,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,kEAAkE,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,wBAAwB,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,KAS5D;IACC,MAAM,gBAAgB,GACpB,MAAM,iDAAiD,CAAC;QACtD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,8BAA8B,EAAE,KAAK,CAAC,8BAA8B;QACpE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,UAAU,EAAE,KAAK,CAAC,kBAAkB;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;KACvE,CAAC,CAAC;IACL,OAAO,0BAA0B,CAAC;QAChC,gBAAgB;QAChB,0BAA0B,EAAE,KAAK,CAAC,eAAe;KAClD,CAAC,CAAC;AACL,CAAC","sourcesContent":["import {\n type AccessEvent,\n type AccessManifest,\n type ContainerAccessManifestState,\n type ContainerDirectGrant,\n type ContainerGrantAccessEventBody,\n type ContainerGrantPrincipalHead,\n type ContainerKekRecipientTarget,\n type ContainerKeyEpoch,\n type ContainerKeyWrap,\n type ContainerUserRecipientKey,\n computeAccessManifestHash,\n deriveContainerAccessManifest,\n} from \"@tearleads/crypto\";\nimport type {\n AccessManifestBundleWire,\n ContainerMutationRequest,\n} from \"@tearleads/validators/request\";\nimport type {\n ContainerKekResponse,\n ContainerWriterProjectionResponse,\n} from \"@tearleads/validators/response\";\nimport { uniquePrincipalPolicies } from \"../../../data/containers/shared/principalPolicies\";\nimport {\n asContainerManifestBundle,\n containerManifestRef,\n getParentKekForTarget,\n readContainerState,\n} from \"../../../data/containers/shared/projection\";\nimport {\n readContainerKekRecipientTargets,\n readContainerKeyEpoch,\n} from \"../../../data/containers/shared/readers\";\nimport type {\n ContainerSharePlan,\n MaterializedContainerSharePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n collectContainerWriterProjectionPrincipalPolicies,\n type PrincipalPolicyCache,\n type ProjectionUserKeyResolver,\n type ReferencedPrincipalPolicyWarmer,\n} from \"../../../data/keyingProjectionVerification\";\nimport type { PrincipalPolicyCurrentEvidence } from \"../../../data/principals/principalPolicyEvidence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport {\n containerMutationRequestCore,\n previousPathRequestFields,\n readCanonicalRecordOrNull,\n} from \"./mutationRequestCore\";\n\nexport type ContainerShareRecipient =\n \| {\n readonly recipientEncapsulationPublicKey: Uint8Array;\n readonly subjectId: string;\n readonly subjectType: \"user\";\n }\n \| {\n readonly principalPolicy: PrincipalPolicyCurrentEvidence;\n readonly subjectId: string;\n readonly subjectType: \"group\";\n };\n\nfunction grantKey(\n grant: Pick<ContainerDirectGrant, \"subjectId\" \| \"subjectType\">,\n): string {\n return `${grant.subjectType}:${grant.subjectId}`;\n}\n\nfunction upsertContainerGrant(\n grants: readonly ContainerDirectGrant[],\n grant: ContainerDirectGrant,\n): ContainerDirectGrant[] {\n return [\n ...grants.filter(\n (existingGrant) => grantKey(existingGrant) !== grantKey(grant),\n ),\n grant,\n ].sort((left, right) => grantKey(left).localeCompare(grantKey(right)));\n}\n\nfunction referencedPrincipalKey(reference: {\n readonly principalId: string;\n readonly principalType: \"group\";\n}): string {\n return `${reference.principalType}:${reference.principalId}`;\n}\n\nexport function referencedPrincipalHeadFromPolicy(\n policy: PrincipalPolicyCurrentEvidence,\n): ContainerGrantPrincipalHead {\n if (policy.principalType !== \"group\") {\n throw new Error(\"Container grants can reference only group policies\");\n }\n return {\n principalType: \"group\",\n principalId: policy.principalId,\n version: policy.version,\n keyEpoch: policy.keyEpoch,\n stateHash: policy.stateHash,\n keyFingerprint: policy.state.keyFingerprint,\n };\n}\n\nfunction upsertReferencedPrincipalHead(\n references: readonly ContainerGrantPrincipalHead[],\n reference: ContainerGrantPrincipalHead,\n): ContainerGrantPrincipalHead[] {\n return [\n ...references.filter(\n (existingReference) =>\n referencedPrincipalKey(existingReference) !==\n referencedPrincipalKey(reference),\n ),\n reference,\n ].sort((left, right) =>\n referencedPrincipalKey(left).localeCompare(referencedPrincipalKey(right)),\n );\n}\n\n/*\n The previous manifest's referenced principal heads with the replacement\n * policy's head upserted in place of any stale head for the same principal.\n * A rekey substitutes references and never adds one: a manifest may reference\n * only principals it grants, so a replacement for one it does not grant —\n * a carried rekey below the container the policy is granted on — is left out.\n /\nexport function refreshedPrincipalReferences(input: {\n readonly previousState: ContainerAccessManifestState;\n readonly replacementPrincipalPolicy?:\n \| PrincipalPolicyCurrentEvidence\n \| undefined;\n}): ContainerGrantPrincipalHead[] {\n const replacement = input.replacementPrincipalPolicy;\n if (\n !replacement \|\|\n !input.previousState.directGrants.some(\n (grant) =>\n grant.subjectType === replacement.principalType &&\n grant.subjectId === replacement.principalId,\n )\n ) {\n return [...input.previousState.referencedPrincipalHeads];\n }\n return upsertReferencedPrincipalHead(\n input.previousState.referencedPrincipalHeads,\n referencedPrincipalHeadFromPolicy(replacement),\n );\n}\n\n/\n The previous policies with the replacement policy substituted for any\n * existing policy of the same principal identity.\n */\nexport function refreshedPrincipalPolicies(input: {\n readonly previousPolicies: readonly PrincipalPolicyCurrentEvidence[];\n readonly replacementPrincipalPolicy?:\n \| PrincipalPolicyCurrentEvidence\n \| undefined;\n}): PrincipalPolicyCurrentEvidence[] {\n const replacement = input.replacementPrincipalPolicy;\n if (!replacement) {\n return uniquePrincipalPolicies(input.previousPolicies);\n }\n return uniquePrincipalPolicies([\n ...input.previousPolicies.filter(\n (policy) =>\n policy.principalType !== replacement.principalType \|\|\n policy.principalId !== replacement.principalId,\n ),\n replacement,\n ]);\n}\n\nexport async function deriveContainerShareManifest(input: {\n eventHash: string;\n grant: ContainerDirectGrant;\n previousManifest: ContainerWriterProjectionResponse[\"path\"][number];\n referencedPrincipalHead: ContainerGrantPrincipalHead \| null;\n}): Promise<Pick<ContainerSharePlan, \"manifest\" \| \"manifestHash\" \| \"state\">> {\n const previousState = readContainerState(input.previousManifest);\n const state: ContainerAccessManifestState = {\n ...previousState,\n epoch: previousState.epoch + 1,\n previousManifestHash: input.previousManifest.manifestHash,\n eventHash: input.eventHash,\n directGrants: upsertContainerGrant(previousState.directGrants, input.grant),\n referencedPrincipalHeads: input.referencedPrincipalHead\n ? upsertReferencedPrincipalHead(\n previousState.referencedPrincipalHeads,\n input.referencedPrincipalHead,\n )\n : previousState.referencedPrincipalHeads,\n };\n const manifest = await deriveContainerAccessManifest(state);\n\n return {\n manifest,\n manifestHash: await computeAccessManifestHash(manifest),\n state,\n };\n}\n\nfunction buildContainerShareRequest(input: {\n body: ContainerGrantAccessEventBody;\n containerManifestHistory: readonly AccessManifestBundleWire[];\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n parentKek: ContainerKekResponse \| null;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n ...containerMutationRequestCore(\"share\", input),\n ...previousPathRequestFields(\n input.previousManifest,\n input.previousProjection,\n ),\n containerManifestHistoryRefs:\n input.containerManifestHistory.map(containerManifestRef),\n predecessorBridge: null,\n keyring: null,\n parentKekState: readCanonicalRecordOrNull(\n input.parentKek,\n \"Container share parent KEK state\",\n ),\n };\n}\n\nexport function replaceContainerWrap(\n wraps: readonly ContainerKeyWrap[],\n nextWrap: ContainerKeyWrap,\n): ContainerKeyWrap[] {\n return [\n ...wraps.filter(\n (wrap) =>\n !(\n wrap.recipientKind === nextWrap.recipientKind &&\n wrap.recipientId === nextWrap.recipientId\n ),\n ),\n nextWrap,\n ];\n}\n\nexport function shareManifestHistory(input: {\n readonly containerId: string;\n readonly targetKek: ContainerKekResponse;\n readonly targetManifest: ContainerWriterProjectionResponse[\"path\"][number];\n}): AccessManifestBundleWire[] {\n const byHash = new Map<string, AccessManifestBundleWire>();\n for (const bundle of [\n input.targetManifest,\n ...input.targetKek.containerManifestHistory,\n ]) {\n if (\n readContainerState(bundle).containerId === input.containerId &&\n !byHash.has(bundle.manifestHash)\n ) {\n byHash.set(bundle.manifestHash, asContainerManifestBundle(bundle));\n }\n }\n return [...byHash.values()];\n}\n\nexport function buildContainerSharePlanResult(input: {\n body: ContainerGrantAccessEventBody;\n containerManifestHistory: readonly AccessManifestBundleWire[];\n containerId: string;\n containerKey: Uint8Array;\n event: AccessEvent;\n eventHash: string;\n grant: ContainerDirectGrant;\n manifest: AccessManifest;\n manifestHash: string;\n previousManifest: AccessManifestBundleWire;\n previousProjection: ContainerWriterProjectionResponse;\n principalPolicies: readonly PrincipalPolicyCurrentEvidence[];\n recipientTarget: ContainerKekRecipientTarget;\n state: ContainerAccessManifestState;\n targetKek: ContainerKekResponse;\n userRecipientKeys: ContainerUserRecipientKey[];\n wraps: ContainerKeyWrap[];\n}): MaterializedContainerSharePlan {\n const keyEpoch = readContainerKeyEpoch(\n input.targetKek.keyEpoch,\n \"Container share key epoch\",\n );\n const plan: ContainerSharePlan = {\n body: input.body,\n containerId: input.containerId,\n event: input.event,\n eventHash: input.eventHash,\n grant: input.grant,\n keyEpoch,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n previousKeyring: readCanonicalRecordOrNull(\n input.previousProjection.containerKeks.at(-1)?.keyring ?? null,\n \"Container share previous keyring\",\n ),\n previousManifest: input.previousManifest,\n recipientTarget: input.recipientTarget,\n request: buildContainerShareRequest({\n body: input.body,\n containerManifestHistory: input.containerManifestHistory,\n event: input.event,\n keyEpoch,\n manifest: input.manifest,\n manifestHash: input.manifestHash,\n parentKek: getParentKekForTarget(input.previousProjection),\n previousManifest: input.previousManifest,\n previousProjection: input.previousProjection,\n principalPolicies: input.principalPolicies,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n }),\n state: input.state,\n userRecipientKeys: input.userRecipientKeys,\n wraps: input.wraps,\n };\n\n return { containerKey: input.containerKey, plan };\n}\n\nexport function collectShareUserRecipientKeys(input: {\n newUserRecipientKey?: ContainerUserRecipientKey \| undefined;\n state: ContainerAccessManifestState;\n targetKek: ContainerKekResponse;\n}): ContainerUserRecipientKey[] {\n const directUserIds = new Set(\n input.state.directGrants.flatMap((grant) =>\n grant.subjectType === \"user\" ? [grant.subjectId] : [],\n ),\n );\n const userRecipientKeyByUserId = new Map<string, ContainerUserRecipientKey>();\n\n for (const target of readContainerKekRecipientTargets(\n input.targetKek.recipientTargets,\n \"Container share target KEK recipient targets\",\n )) {\n if (\n target.recipientKind !== \"user\" \|\|\n !directUserIds.has(target.recipientId)\n ) {\n continue;\n }\n userRecipientKeyByUserId.set(target.recipientId, {\n userId: target.recipientId,\n recipientKeyEpochId: target.recipientKeyEpochId,\n recipientKeyFingerprint: target.recipientKeyFingerprint,\n });\n }\n\n if (input.newUserRecipientKey) {\n userRecipientKeyByUserId.set(\n input.newUserRecipientKey.userId,\n input.newUserRecipientKey,\n );\n }\n\n const missingUserId = [...directUserIds].find(\n (userId) => !userRecipientKeyByUserId.has(userId),\n );\n if (missingUserId) {\n throw new Error(\n `Container share recipient key is missing for direct user grant ${missingUserId}`,\n );\n }\n\n return [...userRecipientKeyByUserId.values()].sort((left, right) =>\n left.userId.localeCompare(right.userId),\n );\n}\n\nexport async function collectContainerSharePrincipalPolicies(input: {\n execSql: ExecSql;\n persistVerificationCheckpoints?: boolean \| undefined;\n principalPolicyCache?: PrincipalPolicyCache \| undefined;\n previousProjection: ContainerWriterProjectionResponse;\n recipientPolicy?: PrincipalPolicyCurrentEvidence \| undefined;\n resolveUserKey: ProjectionUserKeyResolver;\n stillCurrent?: (() => boolean) \| undefined;\n warmReferencedPrincipalPolicies?: ReferencedPrincipalPolicyWarmer \| undefined;\n}): Promise<PrincipalPolicyCurrentEvidence[]> {\n const previousPolicies =\n await collectContainerWriterProjectionPrincipalPolicies({\n execSql: input.execSql,\n persistVerificationCheckpoints: input.persistVerificationCheckpoints,\n principalPolicyCache: input.principalPolicyCache,\n projection: input.previousProjection,\n resolveUserKey: input.resolveUserKey,\n stillCurrent: input.stillCurrent,\n warmReferencedPrincipalPolicies: input.warmReferencedPrincipalPolicies,\n });\n return refreshedPrincipalPolicies({\n previousPolicies,\n replacementPrincipalPolicy: input.recipientPolicy,\n });\n}\n"]}

package/workflows/containers/root/create.js CHANGED Viewed

@@ -54,8 +54,8 @@ function buildRootContainerCreateRequest(input) {
         body: readCanonicalRecord(input.body, "Container root create body"),
         expectedManifestHash: input.manifestHash,
         manifest: readCanonicalRecord(input.manifest, "Container root create manifest"),
-        previousManifest: null,
-        parentContainerPath: [],
+        previousManifestRef: null,
+        parentContainerPathRefs: [],
         principalPolicies: readCanonicalRecords(input.principalPolicies, "Container root create principal policies"),
         keyEpoch: readCanonicalRecord(input.keyEpoch, "Container root create key epoch"),
         predecessorBridge: null,

package/workflows/containers/root/create.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,sBAAsB,CAAC;AAE9B,SAAS,4BAA4B,CAAC,KAQrC;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ;oBACE,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,WAAW;oBACjD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,aAAa;iBACtD;gBACD,GAAG,CAAC,KAAK,CAAC,UAAU;oBAClB,CAAC,CAAC;wBACE;4BACE,WAAW,EAAE,MAAe;4BAC5B,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;4BACvC,WAAW,EAAE,OAAgB;yBAC9B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,wBAAwB,EAAE;gBACxB,KAAK,CAAC,oBAAoB;gBAC1B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,OAAO;gBACpB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACpC,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,KASxC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACtE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC;QACnE,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,gCAAgC,CACjC;QACD,gBAAgB,EAAE,IAAI;QACtB,mBAAmB,EAAE,EAAE;QACvB,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,0CAA0C,CAC3C;QACD,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,iCAAiC,CAClC;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACvE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,2CAA2C,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,UAAiD;IAKjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,oBAAoB,EAAE,IAAI;YAC1B,wBAAwB,EAAE,EAAE;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,WAAW,EAAE,UAAU,CAAC,OAAO;QAC/B,MAAM,EAAE,UAAU,CAAC,kBAAkB;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,wBAAwB,EAAE;YACxB,2CAA2C,CAAC;gBAC1C,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,UAAU,CAAC,kBAAkB;aACtC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,SAAS;QACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB;KAC9D,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,IAAI;KAChC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,CAAC,MAAM,kCAAkC,CAAC;gBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAC7B,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;gBAClE,aAAa,EAAE,KAAK,CAAC,oBAAoB;aAC1C,CAAC,CAAC;YACH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAGC;IAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;QACnC,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,GAAG,KAAK;YACR,+BAA+B,EAC7B,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;YACnE,aAAa,EAAE,KAAK,CAAC,UAAU;SAChC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,gBAAgB,EAAE;YAChB,IAAI,CAAC,eAAe;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;QACD,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB;IACvC,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyD;IAEzD,MAAM,IAAI,GAAG,iCAAiC,CAC5C,iBAAiB,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAC3E,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB;QACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,MAAM,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,GACtD,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,MAAM,gCAAgC,CACnD,KAAK,CAAC,WAAW,IAAI,IAAI,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,UAAU;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,wBAAwB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,yBAAyB,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACL,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAClD,MAAM,2BAA2B,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,oBAAoB;QACpB,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACL,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAwB;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB;QAChB,OAAO,EAAE,+BAA+B,CAAC;YACvC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,iBAAiB,EAAE,wBAAwB;YAC3C,iBAAiB;YACjB,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,IAAyB;IAEzB,OAAO;QACL,cAAc,EAAE;YACd,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,EAAE;YACxB,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;oBAC9D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC;oBAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;gBACvE,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAC/D;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,IAAI;gBAC/B,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,kCAAkC,CACnC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAChE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerCreateAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n normalizeContainerAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n ContainerMutationRequest,\n CreateOrganizationGroupRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerCreatePlan,\n ContainerMutationAuthor,\n MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n readCanonicalJson,\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\n\nimport {\n principalHeadFromInitialGroupPolicy,\n principalPolicyRecordFromInitialGroupPolicy,\n} from \"./initialGroupPolicy\";\n\nfunction buildRootContainerCreateBody(input: {\n author: ContainerMutationAuthor;\n managedPrincipalHead: ContainerGrantPrincipalHead \| null;\n containerKeyEpochId: string;\n containerKeyPublicKey: string;\n metadataDocumentId: string;\n memberHead: ContainerGrantPrincipalHead \| null;\n systemSlot: ContainerSystemSlot \| null;\n}): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: input.systemSlot,\n containerKeyEpochId: input.containerKeyEpochId,\n containerKeyPublicKey: input.containerKeyPublicKey,\n metadataDocumentId: input.metadataDocumentId,\n parentContainerId: null,\n parentManifestHash: null,\n });\n if (input.managedPrincipalHead) {\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: \"admin\",\n subjectId: input.managedPrincipalHead.principalId,\n subjectType: input.managedPrincipalHead.principalType,\n },\n ...(input.memberHead\n ? [\n {\n accessLevel: \"read\" as const,\n subjectId: input.memberHead.principalId,\n subjectType: \"group\" as const,\n },\n ]\n : []),\n ],\n referencedPrincipalHeads: [\n input.managedPrincipalHead,\n ...(input.memberHead ? [input.memberHead] : []),\n ],\n };\n }\n\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: \"admin\",\n subjectId: input.author.signerUserId,\n subjectType: \"user\",\n },\n ],\n };\n}\n\nfunction buildRootContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n principalPolicies: readonly Record<string, unknown>[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n event: readCanonicalRecord(input.event, \"Container root create event\"),\n body: readCanonicalRecord(input.body, \"Container root create body\"),\n expectedManifestHash: input.manifestHash,\n manifest: readCanonicalRecord(\n input.manifest,\n \"Container root create manifest\",\n ),\n previousManifest: null,\n parentContainerPath: [],\n principalPolicies: readCanonicalRecords(\n input.principalPolicies,\n \"Container root create principal policies\",\n ),\n keyEpoch: readCanonicalRecord(\n input.keyEpoch,\n \"Container root create key epoch\",\n ),\n predecessorBridge: null,\n keyring: null,\n wraps: readCanonicalRecords(input.wraps, \"Container root create wraps\"),\n userRecipientKeys: readCanonicalRecords(\n input.userRecipientKeys,\n \"Container root create user recipient keys\",\n ),\n };\n}\n\nasync function buildRootManagedPrincipalContext(\n adminGroup: CreateOrganizationGroupRequest \| null,\n): Promise<{\n managedPrincipalHead: ContainerGrantPrincipalHead \| null;\n managedPrincipalPolicies: Record<string, unknown>[];\n}> {\n if (!adminGroup) {\n return {\n managedPrincipalHead: null,\n managedPrincipalPolicies: [],\n };\n }\n\n const managedPrincipalHead = await principalHeadFromInitialGroupPolicy({\n principalId: adminGroup.groupId,\n policy: adminGroup.initialGroupPolicy,\n });\n\n return {\n managedPrincipalHead,\n managedPrincipalPolicies: [\n principalPolicyRecordFromInitialGroupPolicy({\n head: managedPrincipalHead,\n policy: adminGroup.initialGroupPolicy,\n }),\n ],\n };\n}\n\nasync function deriveRootCreateArtifacts(input: {\n author: ContainerMutationAuthor;\n body: ContainerCreateAccessEventBody;\n containerId: string;\n containerKeyEpochId: string;\n metadataDocumentId: string;\n signedAt: string \| undefined;\n}) {\n if (!input.body.containerKeyPublicKey)\n throw new Error(\"Root container public key is missing\");\n const { event, eventHash } = await signContainerCreateEvent({\n author: input.author,\n body: input.body,\n containerId: input.containerId,\n eventId: crypto.randomUUID(),\n // A root container belongs to the creator's own organization.\n organizationId: input.author.organizationId,\n parentPath: [],\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: input.body.systemSlot,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n containerKeyPublicKey: input.body.containerKeyPublicKey,\n directGrants: input.body.directGrants,\n eventHash,\n metadataDocumentId: input.metadataDocumentId,\n // A root container belongs to the creator's own organization.\n organizationId: input.author.organizationId,\n parentContainerId: null,\n parentManifestHash: null,\n referencedPrincipalHeads: input.body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: null,\n });\n return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\nasync function wrapRootContainerKeyForPlan(input: {\n adminGroup: CreateOrganizationGroupRequest \| null;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n manifestHash: string;\n managedPrincipalHead: ContainerGrantPrincipalHead \| null;\n recipientEncapsulationPublicKey: Uint8Array;\n userId: string;\n}) {\n if (input.adminGroup && input.managedPrincipalHead) {\n return {\n ...(await wrapContainerKeyToManagedPrincipal({\n containerKey: input.containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n manifestHash: input.manifestHash,\n principalEncapsulationPublicKey:\n input.adminGroup.initialGroupPolicy.state.encapsulationPublicKey,\n principalHead: input.managedPrincipalHead,\n })),\n userRecipientKey: null,\n };\n }\n\n return wrapContainerKeyToRootUser({\n containerKey: input.containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n manifestHash: input.manifestHash,\n recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n userId: input.userId,\n });\n}\n\nasync function wrapRootContainerRecipients(\n input: Parameters<typeof wrapRootContainerKeyForPlan>[0] & {\n memberGroup: CreateOrganizationGroupRequest \| null;\n memberHead: ContainerGrantPrincipalHead \| null;\n },\n) {\n const root = await wrapRootContainerKeyForPlan(input);\n const member =\n input.memberGroup && input.memberHead\n ? await wrapContainerKeyToManagedPrincipal({\n ...input,\n principalEncapsulationPublicKey:\n input.memberGroup.initialGroupPolicy.state.encapsulationPublicKey,\n principalHead: input.memberHead,\n })\n : null;\n return {\n recipientTargets: [\n root.recipientTarget,\n ...(member ? [member.recipientTarget] : []),\n ],\n wraps: [root.wrap, ...(member ? [member.wrap] : [])],\n userRecipientKeys: root.userRecipientKey ? [root.userRecipientKey] : [],\n };\n}\n\nfunction rootKeyMaterial(key?: Uint8Array): Uint8Array {\n const material = key ?? crypto.getRandomValues(new Uint8Array(32));\n if (material.byteLength !== 32)\n throw new Error(\"Container KEK material must be 32 bytes\");\n return material;\n}\n\nfunction normalizedRootCreateBody(\n input: Parameters<typeof buildRootContainerCreateBody>[0],\n): ContainerCreateAccessEventBody {\n const body = normalizeContainerAccessEventBody(\n readCanonicalJson(buildRootContainerCreateBody(input), \"Root create body\"),\n );\n if (body.eventType !== \"container.create\")\n throw new Error(\"Expected root creation body\");\n return body;\n}\n\nexport async function buildRootContainerCreatePlan(input: {\n adminGroup?: CreateOrganizationGroupRequest \| undefined;\n memberGroup?: CreateOrganizationGroupRequest \| undefined;\n systemSlot?: ContainerSystemSlot \| undefined;\n author: ContainerMutationAuthor;\n containerId: string;\n containerKey?: Uint8Array \| undefined;\n metadataDocumentId: string;\n recipientEncapsulationPublicKey: Uint8Array;\n signedAt?: string \| undefined;\n}): Promise<MaterializedContainerCreatePlan> {\n const containerKey = rootKeyMaterial(input.containerKey);\n const adminGroup = input.adminGroup ?? null;\n const { managedPrincipalHead, managedPrincipalPolicies } =\n await buildRootManagedPrincipalContext(adminGroup);\n\n const member = await buildRootManagedPrincipalContext(\n input.memberGroup ?? null,\n );\n if (input.memberGroup && !adminGroup)\n throw new Error(\"Members root grant requires Admins authority\");\n managedPrincipalPolicies.push(...member.managedPrincipalPolicies);\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.containerId,\n keyEpoch: 1,\n keyMaterial: containerKey,\n });\n const body = normalizedRootCreateBody({\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: input.containerId,\n keyMaterial: containerKey,\n }),\n memberHead: member.managedPrincipalHead,\n systemSlot: input.systemSlot ?? null,\n author: input.author,\n containerKeyEpochId,\n managedPrincipalHead,\n metadataDocumentId: input.metadataDocumentId,\n });\n const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveRootCreateArtifacts({\n author: input.author,\n body,\n containerId: input.containerId,\n containerKeyEpochId,\n metadataDocumentId: input.metadataDocumentId,\n signedAt: input.signedAt,\n });\n const { recipientTargets, wraps, userRecipientKeys } =\n await wrapRootContainerRecipients({\n memberGroup: input.memberGroup ?? null,\n memberHead: member.managedPrincipalHead,\n adminGroup,\n containerKey,\n containerKeyEpochId,\n manifestHash,\n managedPrincipalHead,\n recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n userId: input.author.signerUserId,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n const plan: ContainerCreatePlan = {\n body,\n containerId: input.containerId,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: input.metadataDocumentId,\n parentContainerId: null,\n parentManifestHash: null,\n recipientTargets,\n request: buildRootContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n principalPolicies: managedPrincipalPolicies,\n userRecipientKeys,\n wraps,\n }),\n state,\n wraps,\n };\n\n return { containerKey, plan };\n}\n\nexport function rootContainerWriterProjectionFromCreatePlan(\n plan: ContainerCreatePlan,\n): ContainerWriterProjectionResponse {\n return {\n policyEvidence: {\n organization: null,\n organizationPayloads: [],\n groups: [],\n },\n containerId: plan.containerId,\n organizationId: plan.state.organizationId,\n path: [\n {\n event: {\n event: readCanonicalRecord(plan.event, \"Container root event\"),\n body: readCanonicalRecord(plan.body, \"Container root body\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(plan.manifest, \"Container root manifest\"),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container root state\"),\n },\n ],\n containerKeks: [\n {\n containerId: plan.containerId,\n accessManifestHash: plan.manifestHash,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n keyEpoch: readCanonicalRecord(\n plan.keyEpoch,\n \"Container root key epoch\",\n ),\n keyEpochHash: plan.keyEpochHash,\n keyTargetHash: plan.keyTargetHash,\n containerManifestHistory: [],\n parentContainerKeyEpochId: null,\n keyring: null,\n recipientTargets: readCanonicalRecords(\n plan.recipientTargets,\n \"Container root recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container root wraps\"),\n },\n ],\n };\n}\n"]}
1	+ {"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AASA,OAAO,EACL,sCAAsC,EACtC,4BAA4B,EAC5B,mCAAmC,EACnC,iCAAiC,GAClC,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,kCAAkC,EAClC,0BAA0B,GAC3B,MAAM,4CAA4C,CAAC;AAMpD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,mCAAmC,EACnC,2CAA2C,GAC5C,MAAM,sBAAsB,CAAC;AAE9B,SAAS,4BAA4B,CAAC,KAQrC;IACC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,QAAQ;YACX,YAAY,EAAE;gBACZ;oBACE,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,KAAK,CAAC,oBAAoB,CAAC,WAAW;oBACjD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,aAAa;iBACtD;gBACD,GAAG,CAAC,KAAK,CAAC,UAAU;oBAClB,CAAC,CAAC;wBACE;4BACE,WAAW,EAAE,MAAe;4BAC5B,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW;4BACvC,WAAW,EAAE,OAAgB;yBAC9B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,wBAAwB,EAAE;gBACxB,KAAK,CAAC,oBAAoB;gBAC1B,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,YAAY,EAAE;YACZ;gBACE,WAAW,EAAE,OAAO;gBACpB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;gBACpC,WAAW,EAAE,MAAM;aACpB;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,KASxC;IACC,OAAO;QACL,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACtE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC;QACnE,oBAAoB,EAAE,KAAK,CAAC,YAAY;QACxC,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,gCAAgC,CACjC;QACD,mBAAmB,EAAE,IAAI;QACzB,uBAAuB,EAAE,EAAE;QAC3B,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,0CAA0C,CAC3C;QACD,QAAQ,EAAE,mBAAmB,CAC3B,KAAK,CAAC,QAAQ,EACd,iCAAiC,CAClC;QACD,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC;QACvE,iBAAiB,EAAE,oBAAoB,CACrC,KAAK,CAAC,iBAAiB,EACvB,2CAA2C,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gCAAgC,CAC7C,UAAiD;IAKjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,oBAAoB,EAAE,IAAI;YAC1B,wBAAwB,EAAE,EAAE;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,mCAAmC,CAAC;QACrE,WAAW,EAAE,UAAU,CAAC,OAAO;QAC/B,MAAM,EAAE,UAAU,CAAC,kBAAkB;KACtC,CAAC,CAAC;IAEH,OAAO;QACL,oBAAoB;QACpB,wBAAwB,EAAE;YACxB,2CAA2C,CAAC;gBAC1C,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,UAAU,CAAC,kBAAkB;aACtC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,KAOxC;IACC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACnC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,wBAAwB,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5B,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrD,CAAC,CAAC;IACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,6BAA6B,CAC3E;QACE,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;QACvD,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY;QACrC,SAAS;QACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,8DAA8D;QAC9D,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;QAC3C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB;KAC9D,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,4BAA4B,CAAC;QAC5C,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,SAAS;QACT,YAAY;QACZ,yBAAyB,EAAE,IAAI;KAChC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACnD,OAAO;YACL,GAAG,CAAC,MAAM,kCAAkC,CAAC;gBAC3C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;gBAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,+BAA+B,EAC7B,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;gBAClE,aAAa,EAAE,KAAK,CAAC,oBAAoB;aAC1C,CAAC,CAAC;YACH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,0BAA0B,CAAC;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,KAGC;IAED,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,MAAM,GACV,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU;QACnC,CAAC,CAAC,MAAM,kCAAkC,CAAC;YACvC,GAAG,KAAK;YACR,+BAA+B,EAC7B,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,sBAAsB;YACnE,aAAa,EAAE,KAAK,CAAC,UAAU;SAChC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,OAAO;QACL,gBAAgB,EAAE;YAChB,IAAI,CAAC,eAAe;YACpB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C;QACD,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB;IACvC,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,UAAU,KAAK,EAAE;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyD;IAEzD,MAAM,IAAI,GAAG,iCAAiC,CAC5C,iBAAiB,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAC3E,CAAC;IACF,IAAI,IAAI,CAAC,SAAS,KAAK,kBAAkB;QACvC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAUlD;IACC,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IAC5C,MAAM,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,GACtD,MAAM,gCAAgC,CAAC,UAAU,CAAC,CAAC;IAErD,MAAM,MAAM,GAAG,MAAM,gCAAgC,CACnD,KAAK,CAAC,WAAW,IAAI,IAAI,CAC1B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,UAAU;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,wBAAwB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,CAAC;QAC3D,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;YAC/D,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,YAAY;SAC1B,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,mBAAmB;QACnB,oBAAoB;QACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IACH,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GACjE,MAAM,yBAAyB,CAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACL,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAClD,MAAM,2BAA2B,CAAC;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;QACtC,UAAU,EAAE,MAAM,CAAC,oBAAoB;QACvC,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,YAAY;QACZ,oBAAoB;QACpB,+BAA+B,EAAE,KAAK,CAAC,+BAA+B;QACtE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;KAClC,CAAC,CAAC;IACL,MAAM,aAAa,GACjB,MAAM,sCAAsC,CAAC,gBAAgB,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAwB;QAChC,IAAI;QACJ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,mBAAmB;QACnB,KAAK;QACL,SAAS;QACT,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,QAAQ;QACR,YAAY;QACZ,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,iBAAiB,EAAE,IAAI;QACvB,kBAAkB,EAAE,IAAI;QACxB,gBAAgB;QAChB,OAAO,EAAE,+BAA+B,CAAC;YACvC,IAAI;YACJ,KAAK;YACL,QAAQ;YACR,QAAQ;YACR,YAAY;YACZ,iBAAiB,EAAE,wBAAwB;YAC3C,iBAAiB;YACjB,KAAK;SACN,CAAC;QACF,KAAK;QACL,KAAK;KACN,CAAC;IAEF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,IAAyB;IAEzB,OAAO;QACL,cAAc,EAAE;YACd,YAAY,EAAE,IAAI;YAClB,oBAAoB,EAAE,EAAE;YACxB,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc;QACzC,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE;oBACL,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;oBAC9D,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC;oBAC3D,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B;gBACD,QAAQ,EAAE,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;gBACvE,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAC/D;SACF;QACD,aAAa,EAAE;YACb;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,kBAAkB,EAAE,IAAI,CAAC,YAAY;gBACrC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBACzC,QAAQ,EAAE,mBAAmB,CAC3B,IAAI,CAAC,QAAQ,EACb,0BAA0B,CAC3B;gBACD,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,wBAAwB,EAAE,EAAE;gBAC5B,yBAAyB,EAAE,IAAI;gBAC/B,OAAO,EAAE,IAAI;gBACb,gBAAgB,EAAE,oBAAoB,CACpC,IAAI,CAAC,gBAAgB,EACrB,kCAAkC,CACnC;gBACD,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC;aAChE;SACF;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type {\n AccessEvent,\n AccessManifest,\n ContainerCreateAccessEventBody,\n ContainerGrantPrincipalHead,\n ContainerKeyEpoch,\n ContainerKeyWrap,\n ContainerUserRecipientKey,\n} from \"@tearleads/crypto\";\nimport {\n computeContainerKekRecipientTargetHash,\n computeContainerKeyEpochHash,\n deriveContainerKekWrappingPublicKey,\n normalizeContainerAccessEventBody,\n} from \"@tearleads/crypto\";\nimport type { ContainerSystemSlot } from \"@tearleads/validators/containerSystemSlot\";\nimport type {\n ContainerMutationRequest,\n CreateOrganizationGroupRequest,\n} from \"@tearleads/validators/request\";\nimport type { ContainerWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n buildContainerCreateBody,\n buildContainerCreateKeyEpoch,\n deriveContainerCreateManifest,\n resolveContainerKekEpochId,\n signContainerCreateEvent,\n} from \"../../../data/containers/shared/events\";\nimport {\n wrapContainerKeyToManagedPrincipal,\n wrapContainerKeyToRootUser,\n} from \"../../../data/containers/shared/projection\";\nimport type {\n ContainerCreatePlan,\n ContainerMutationAuthor,\n MaterializedContainerCreatePlan,\n} from \"../../../data/containers/shared/types\";\nimport {\n readCanonicalJson,\n readCanonicalRecord,\n readCanonicalRecords,\n} from \"../../../data/keyingCanonicalJson\";\n\nimport {\n principalHeadFromInitialGroupPolicy,\n principalPolicyRecordFromInitialGroupPolicy,\n} from \"./initialGroupPolicy\";\n\nfunction buildRootContainerCreateBody(input: {\n author: ContainerMutationAuthor;\n managedPrincipalHead: ContainerGrantPrincipalHead \| null;\n containerKeyEpochId: string;\n containerKeyPublicKey: string;\n metadataDocumentId: string;\n memberHead: ContainerGrantPrincipalHead \| null;\n systemSlot: ContainerSystemSlot \| null;\n}): ContainerCreateAccessEventBody {\n const baseBody = buildContainerCreateBody({\n systemSlot: input.systemSlot,\n containerKeyEpochId: input.containerKeyEpochId,\n containerKeyPublicKey: input.containerKeyPublicKey,\n metadataDocumentId: input.metadataDocumentId,\n parentContainerId: null,\n parentManifestHash: null,\n });\n if (input.managedPrincipalHead) {\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: \"admin\",\n subjectId: input.managedPrincipalHead.principalId,\n subjectType: input.managedPrincipalHead.principalType,\n },\n ...(input.memberHead\n ? [\n {\n accessLevel: \"read\" as const,\n subjectId: input.memberHead.principalId,\n subjectType: \"group\" as const,\n },\n ]\n : []),\n ],\n referencedPrincipalHeads: [\n input.managedPrincipalHead,\n ...(input.memberHead ? [input.memberHead] : []),\n ],\n };\n }\n\n return {\n ...baseBody,\n directGrants: [\n {\n accessLevel: \"admin\",\n subjectId: input.author.signerUserId,\n subjectType: \"user\",\n },\n ],\n };\n}\n\nfunction buildRootContainerCreateRequest(input: {\n body: ContainerCreateAccessEventBody;\n event: AccessEvent;\n keyEpoch: ContainerKeyEpoch;\n manifest: AccessManifest;\n manifestHash: string;\n principalPolicies: readonly Record<string, unknown>[];\n userRecipientKeys: readonly ContainerUserRecipientKey[];\n wraps: readonly ContainerKeyWrap[];\n}): ContainerMutationRequest {\n return {\n event: readCanonicalRecord(input.event, \"Container root create event\"),\n body: readCanonicalRecord(input.body, \"Container root create body\"),\n expectedManifestHash: input.manifestHash,\n manifest: readCanonicalRecord(\n input.manifest,\n \"Container root create manifest\",\n ),\n previousManifestRef: null,\n parentContainerPathRefs: [],\n principalPolicies: readCanonicalRecords(\n input.principalPolicies,\n \"Container root create principal policies\",\n ),\n keyEpoch: readCanonicalRecord(\n input.keyEpoch,\n \"Container root create key epoch\",\n ),\n predecessorBridge: null,\n keyring: null,\n wraps: readCanonicalRecords(input.wraps, \"Container root create wraps\"),\n userRecipientKeys: readCanonicalRecords(\n input.userRecipientKeys,\n \"Container root create user recipient keys\",\n ),\n };\n}\n\nasync function buildRootManagedPrincipalContext(\n adminGroup: CreateOrganizationGroupRequest \| null,\n): Promise<{\n managedPrincipalHead: ContainerGrantPrincipalHead \| null;\n managedPrincipalPolicies: Record<string, unknown>[];\n}> {\n if (!adminGroup) {\n return {\n managedPrincipalHead: null,\n managedPrincipalPolicies: [],\n };\n }\n\n const managedPrincipalHead = await principalHeadFromInitialGroupPolicy({\n principalId: adminGroup.groupId,\n policy: adminGroup.initialGroupPolicy,\n });\n\n return {\n managedPrincipalHead,\n managedPrincipalPolicies: [\n principalPolicyRecordFromInitialGroupPolicy({\n head: managedPrincipalHead,\n policy: adminGroup.initialGroupPolicy,\n }),\n ],\n };\n}\n\nasync function deriveRootCreateArtifacts(input: {\n author: ContainerMutationAuthor;\n body: ContainerCreateAccessEventBody;\n containerId: string;\n containerKeyEpochId: string;\n metadataDocumentId: string;\n signedAt: string \| undefined;\n}) {\n if (!input.body.containerKeyPublicKey)\n throw new Error(\"Root container public key is missing\");\n const { event, eventHash } = await signContainerCreateEvent({\n author: input.author,\n body: input.body,\n containerId: input.containerId,\n eventId: crypto.randomUUID(),\n // A root container belongs to the creator's own organization.\n organizationId: input.author.organizationId,\n parentPath: [],\n signedAt: input.signedAt ?? new Date().toISOString(),\n });\n const { manifest, manifestHash, state } = await deriveContainerCreateManifest(\n {\n systemSlot: input.body.systemSlot,\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n containerKeyPublicKey: input.body.containerKeyPublicKey,\n directGrants: input.body.directGrants,\n eventHash,\n metadataDocumentId: input.metadataDocumentId,\n // A root container belongs to the creator's own organization.\n organizationId: input.author.organizationId,\n parentContainerId: null,\n parentManifestHash: null,\n referencedPrincipalHeads: input.body.referencedPrincipalHeads,\n },\n );\n const keyEpoch = buildContainerCreateKeyEpoch({\n containerId: input.containerId,\n containerKeyEpochId: input.containerKeyEpochId,\n eventHash,\n manifestHash,\n parentContainerKeyEpochId: null,\n });\n return { event, eventHash, keyEpoch, manifest, manifestHash, state };\n}\n\nasync function wrapRootContainerKeyForPlan(input: {\n adminGroup: CreateOrganizationGroupRequest \| null;\n containerKey: Uint8Array;\n containerKeyEpochId: string;\n manifestHash: string;\n managedPrincipalHead: ContainerGrantPrincipalHead \| null;\n recipientEncapsulationPublicKey: Uint8Array;\n userId: string;\n}) {\n if (input.adminGroup && input.managedPrincipalHead) {\n return {\n ...(await wrapContainerKeyToManagedPrincipal({\n containerKey: input.containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n manifestHash: input.manifestHash,\n principalEncapsulationPublicKey:\n input.adminGroup.initialGroupPolicy.state.encapsulationPublicKey,\n principalHead: input.managedPrincipalHead,\n })),\n userRecipientKey: null,\n };\n }\n\n return wrapContainerKeyToRootUser({\n containerKey: input.containerKey,\n containerKeyEpochId: input.containerKeyEpochId,\n manifestHash: input.manifestHash,\n recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n userId: input.userId,\n });\n}\n\nasync function wrapRootContainerRecipients(\n input: Parameters<typeof wrapRootContainerKeyForPlan>[0] & {\n memberGroup: CreateOrganizationGroupRequest \| null;\n memberHead: ContainerGrantPrincipalHead \| null;\n },\n) {\n const root = await wrapRootContainerKeyForPlan(input);\n const member =\n input.memberGroup && input.memberHead\n ? await wrapContainerKeyToManagedPrincipal({\n ...input,\n principalEncapsulationPublicKey:\n input.memberGroup.initialGroupPolicy.state.encapsulationPublicKey,\n principalHead: input.memberHead,\n })\n : null;\n return {\n recipientTargets: [\n root.recipientTarget,\n ...(member ? [member.recipientTarget] : []),\n ],\n wraps: [root.wrap, ...(member ? [member.wrap] : [])],\n userRecipientKeys: root.userRecipientKey ? [root.userRecipientKey] : [],\n };\n}\n\nfunction rootKeyMaterial(key?: Uint8Array): Uint8Array {\n const material = key ?? crypto.getRandomValues(new Uint8Array(32));\n if (material.byteLength !== 32)\n throw new Error(\"Container KEK material must be 32 bytes\");\n return material;\n}\n\nfunction normalizedRootCreateBody(\n input: Parameters<typeof buildRootContainerCreateBody>[0],\n): ContainerCreateAccessEventBody {\n const body = normalizeContainerAccessEventBody(\n readCanonicalJson(buildRootContainerCreateBody(input), \"Root create body\"),\n );\n if (body.eventType !== \"container.create\")\n throw new Error(\"Expected root creation body\");\n return body;\n}\n\nexport async function buildRootContainerCreatePlan(input: {\n adminGroup?: CreateOrganizationGroupRequest \| undefined;\n memberGroup?: CreateOrganizationGroupRequest \| undefined;\n systemSlot?: ContainerSystemSlot \| undefined;\n author: ContainerMutationAuthor;\n containerId: string;\n containerKey?: Uint8Array \| undefined;\n metadataDocumentId: string;\n recipientEncapsulationPublicKey: Uint8Array;\n signedAt?: string \| undefined;\n}): Promise<MaterializedContainerCreatePlan> {\n const containerKey = rootKeyMaterial(input.containerKey);\n const adminGroup = input.adminGroup ?? null;\n const { managedPrincipalHead, managedPrincipalPolicies } =\n await buildRootManagedPrincipalContext(adminGroup);\n\n const member = await buildRootManagedPrincipalContext(\n input.memberGroup ?? null,\n );\n if (input.memberGroup && !adminGroup)\n throw new Error(\"Members root grant requires Admins authority\");\n managedPrincipalPolicies.push(...member.managedPrincipalPolicies);\n const containerKeyEpochId = await resolveContainerKekEpochId({\n containerId: input.containerId,\n keyEpoch: 1,\n keyMaterial: containerKey,\n });\n const body = normalizedRootCreateBody({\n containerKeyPublicKey: await deriveContainerKekWrappingPublicKey({\n containerId: input.containerId,\n keyMaterial: containerKey,\n }),\n memberHead: member.managedPrincipalHead,\n systemSlot: input.systemSlot ?? null,\n author: input.author,\n containerKeyEpochId,\n managedPrincipalHead,\n metadataDocumentId: input.metadataDocumentId,\n });\n const { event, eventHash, keyEpoch, manifest, manifestHash, state } =\n await deriveRootCreateArtifacts({\n author: input.author,\n body,\n containerId: input.containerId,\n containerKeyEpochId,\n metadataDocumentId: input.metadataDocumentId,\n signedAt: input.signedAt,\n });\n const { recipientTargets, wraps, userRecipientKeys } =\n await wrapRootContainerRecipients({\n memberGroup: input.memberGroup ?? null,\n memberHead: member.managedPrincipalHead,\n adminGroup,\n containerKey,\n containerKeyEpochId,\n manifestHash,\n managedPrincipalHead,\n recipientEncapsulationPublicKey: input.recipientEncapsulationPublicKey,\n userId: input.author.signerUserId,\n });\n const keyTargetHash =\n await computeContainerKekRecipientTargetHash(recipientTargets);\n const keyEpochHash = await computeContainerKeyEpochHash(keyEpoch);\n const plan: ContainerCreatePlan = {\n body,\n containerId: input.containerId,\n containerKeyEpochId,\n event,\n eventHash,\n keyEpoch,\n keyEpochHash,\n keyTargetHash,\n manifest,\n manifestHash,\n metadataDocumentId: input.metadataDocumentId,\n parentContainerId: null,\n parentManifestHash: null,\n recipientTargets,\n request: buildRootContainerCreateRequest({\n body,\n event,\n keyEpoch,\n manifest,\n manifestHash,\n principalPolicies: managedPrincipalPolicies,\n userRecipientKeys,\n wraps,\n }),\n state,\n wraps,\n };\n\n return { containerKey, plan };\n}\n\nexport function rootContainerWriterProjectionFromCreatePlan(\n plan: ContainerCreatePlan,\n): ContainerWriterProjectionResponse {\n return {\n policyEvidence: {\n organization: null,\n organizationPayloads: [],\n groups: [],\n },\n containerId: plan.containerId,\n organizationId: plan.state.organizationId,\n path: [\n {\n event: {\n event: readCanonicalRecord(plan.event, \"Container root event\"),\n body: readCanonicalRecord(plan.body, \"Container root body\"),\n eventHash: plan.eventHash,\n },\n manifest: readCanonicalRecord(plan.manifest, \"Container root manifest\"),\n manifestHash: plan.manifestHash,\n state: readCanonicalRecord(plan.state, \"Container root state\"),\n },\n ],\n containerKeks: [\n {\n containerId: plan.containerId,\n accessManifestHash: plan.manifestHash,\n containerKeyEpochId: plan.containerKeyEpochId,\n containerKeyEpoch: plan.keyEpoch.keyEpoch,\n keyEpoch: readCanonicalRecord(\n plan.keyEpoch,\n \"Container root key epoch\",\n ),\n keyEpochHash: plan.keyEpochHash,\n keyTargetHash: plan.keyTargetHash,\n containerManifestHistory: [],\n parentContainerKeyEpochId: null,\n keyring: null,\n recipientTargets: readCanonicalRecords(\n plan.recipientTargets,\n \"Container root recipient targets\",\n ),\n wraps: readCanonicalRecords(plan.wraps, \"Container root wraps\"),\n },\n ],\n };\n}\n"]}

package/workflows/registration/provisioningBootstrapBuilders.d.ts CHANGED Viewed

@@ -149,11 +149,6 @@ export declare function buildInitialRootProvisioning(input: {
             manifestHash: string;
             state: Record<string, unknown>;
         }[];
-        historyPrefixes?: {
-            key: string;
-            count: number;
-            digest: string;
-        }[] | undefined;
     };
     rootMetadataDocument: import("../../data/documents/shared/types.js").MaterializedDocumentCreatePlan;
     rootMetadataDocumentRequest: {
@@ -188,36 +183,26 @@ export declare function buildInitialRootProvisioning(input: {
                 predecessorBridge: Record<string, unknown> | null;
                 principalPolicies: Record<string, unknown>[];
                 wraps: Record<string, unknown>[];
-                containerManifestHistory?: {
-                    event: Record<string, unknown>;
-                    manifest: Record<string, unknown>;
+                containerManifestHistoryRefs?: {
+                    containerId: string;
                     manifestHash: string;
-                    state: Record<string, unknown>;
                 }[] | undefined;
-                destinationParentContainerPath?: {
-                    event: Record<string, unknown>;
-                    manifest: Record<string, unknown>;
+                destinationParentContainerPathRefs?: {
+                    containerId: string;
                     manifestHash: string;
-                    state: Record<string, unknown>;
                 }[] | undefined;
-                parentContainerPath?: {
-                    event: Record<string, unknown>;
-                    manifest: Record<string, unknown>;
+                parentContainerPathRefs?: {
+                    containerId: string;
                     manifestHash: string;
-                    state: Record<string, unknown>;
                 }[] | undefined;
                 parentKekState?: Record<string, unknown> | null | undefined;
-                previousContainerPath?: {
-                    event: Record<string, unknown>;
-                    manifest: Record<string, unknown>;
+                previousContainerPathRefs?: {
+                    containerId: string;
                     manifestHash: string;
-                    state: Record<string, unknown>;
                 }[] | undefined;
-                previousManifest?: {
-                    event: Record<string, unknown>;
-                    manifest: Record<string, unknown>;
+                previousManifestRef?: {
+                    containerId: string;
                     manifestHash: string;
-                    state: Record<string, unknown>;
                 } | null | undefined;
                 userRecipientKeys?: Record<string, unknown>[] | undefined;
             }[] | undefined;
@@ -270,45 +255,29 @@ export declare function buildInitialRootProvisioning(input: {
             predecessorBridge: Record<string, unknown> | null;
             principalPolicies: Record<string, unknown>[];
             wraps: Record<string, unknown>[];
-            containerManifestHistory?: {
-                event: Record<string, unknown>;
-                manifest: Record<string, unknown>;
+            containerManifestHistoryRefs?: {
+                containerId: string;
                 manifestHash: string;
-                state: Record<string, unknown>;
             }[] | undefined;
-            destinationParentContainerPath?: {
-                event: Record<string, unknown>;
-                manifest: Record<string, unknown>;
+            destinationParentContainerPathRefs?: {
+                containerId: string;
                 manifestHash: string;
-                state: Record<string, unknown>;
             }[] | undefined;
-            parentContainerPath?: {
-                event: Record<string, unknown>;
-                manifest: Record<string, unknown>;
+            parentContainerPathRefs?: {
+                containerId: string;
                 manifestHash: string;
-                state: Record<string, unknown>;
             }[] | undefined;
             parentKekState?: Record<string, unknown> | null | undefined;
-            previousContainerPath?: {
-                event: Record<string, unknown>;
-                manifest: Record<string, unknown>;
+            previousContainerPathRefs?: {
+                containerId: string;
                 manifestHash: string;
-                state: Record<string, unknown>;
             }[] | undefined;
-            previousManifest?: {
-                event: Record<string, unknown>;
-                manifest: Record<string, unknown>;
+            previousManifestRef?: {
+                containerId: string;
                 manifestHash: string;
-                state: Record<string, unknown>;
             } | null | undefined;
             userRecipientKeys?: Record<string, unknown>[] | undefined;
         }[] | undefined;
-        previousManifest?: {
-            event: Record<string, unknown>;
-            manifest: Record<string, unknown>;
-            manifestHash: string;
-            state: Record<string, unknown>;
-        } | null | undefined;
         targetContainerPathRefs?: {
             containerId: string;
             manifestHash: string;

package/workflows/sync/remoteReset.js CHANGED Viewed

@@ -2,12 +2,14 @@ import { and, eq, inArray, or } from "drizzle-orm";
 import { recordSupersededContainerBindingsInTransaction } from "../../data/persistence/container-contents/supersededContainerBindings.js";
 import { deleteDocumentPlacementRowsByContainerIds, deleteDocumentPlacementRowsByDocumentIds, } from "../../data/persistence/containers/documentContainerProjectionPersistence.js";
 import { clearDocumentDiscoveryEvidenceOnRemoteReset } from "../../data/persistence/documents/documentDiscoveryReset.js";
+import { queuedUpdateRow, unqueueDocumentScopesInTransaction, } from "../../data/sqlite/documentPendingUpdatePersistence.js";
 import { documentIntentLinkTargets } from "../../data/sqlite/documentPlacementIntentSchema.js";
 import { organizationDataUsageCategories, organizationDataUsageSnapshots, } from "../../data/sqlite/organizationDataUsageSchema.js";
 import { organizationPresentationDenials, organizationReadModelContainerGrants, organizationReadModelDirectoryUsers, organizationReadModelGroupMembers, organizationReadModelGroups, organizationReadModelRequesters, organizationReadModelState, } from "../../data/sqlite/organizationReadModelSchema.js";
-import { clientSqlTables, containerCreateIntents, containerHydrationTombstones, containerMoveIntents, containers, documentAttachmentBlobProjection, documentMoveIntents, documentPendingAttachments, documentPendingUpdates, documentProjection, documentSyncFailures, documents, dormantContainerMetadata, dormantMetadataSweepRequests, } from "../../data/sqlite/schema.js";
+import { clientSqlTables, containerCreateIntents, containerHydrationTombstones, containerMoveIntents, containers, documentAttachmentBlobProjection, documentHistoryUpdates, documentMoveIntents, documentPendingAttachments, documentProjection, documentSyncFailures, documents, dormantContainerMetadata, dormantMetadataSweepRequests, } from "../../data/sqlite/schema.js";
 import { getClientSQLitePersistenceRuntime, } from "../../data/sqlite/sqlitePersistenceRuntime.js";
 import { ensureSqlTables } from "../../data/sqlite/sqlTableSchema.js";
+import { verifiedAccessManifestBundles } from "../../data/sqlite/verifiedManifestBundleSchema.js";
 import { runOrganizationPresentationReset } from "../organizations/organizationPresentationAccessState.js";
 import { clearResetPendingAttachments } from "./remoteResetAttachments.js";
 import { remoteResetBatches } from "./remoteResetBatches.js";
@@ -75,10 +77,7 @@ async function clearScopedDocumentRows(input) {
             .run();
     }
     for (const documentBatch of remoteResetBatches(snapshot.documentRows)) {
-        await tx
-            .delete(documentPendingUpdates)
-            .where(or(...documentBatch.map((row) => and(eq(documentPendingUpdates.appKind, row.appKind), eq(documentPendingUpdates.localId, row.localId)))))
-            .run();
+        await unqueueDocumentScopesInTransaction(tx, documentBatch);
         await tx
             .delete(documentSyncFailures)
             .where(or(...documentBatch.map((row) => and(eq(documentSyncFailures.appKind, row.appKind), eq(documentSyncFailures.localId, row.localId)))))
@@ -91,6 +90,7 @@ async function clearScopedRemoteRows(input) {
     for (const table of [
         dormantContainerMetadata,
         dormantMetadataSweepRequests,
+        verifiedAccessManifestBundles,
     ]) {
         await tx
             .delete(table)
@@ -171,11 +171,13 @@ async function resetRemoteColumns(input) {
 async function queueResetDocumentUpdates(input) {
     for (const updateBatch of remoteResetBatches(input.documentUpdates)) {
         await input.tx
-            .insert(documentPendingUpdates)
-            .values(updateBatch.map((update) => ({
-            ...update,
-            id: crypto.randomUUID(),
+            .insert(documentHistoryUpdates)
+            .values(updateBatch.map((update) => queuedUpdateRow({
             createdAt: input.now,
+            origin: "outbox",
+            pendingUpdate: update,
+            scope: update,
+            updateId: crypto.randomUUID(),
         })))
             .run();
     }